Remember that even if there's an explicit grant of permissions, you still need to reconcile the Group permissions with Individual permissions, with denials and grants being processed in the right order. I think having denials is fairly rare, as far as real-life situations go, but still worth remembering.